A WAF policy is a separate Azure resource that manages web application firewall capabilities. Associate it with Application Gateway v2 for regional application traffic, or with Azure Front Door for global, multiregional, and potentially multicloud traffic. Use policies rather than legacy Application Gateway WAF configuration. section 3.3.1 section 3.3.2
A policy groups managed rule sets and operating settings. Microsoft-managed OWASP Core Rule Set–based rules can be selected by type and version; managed bot protection can also be added to identify requests from IP addresses associated with known malicious bots. Prefer the latest available rule-set version. section 3.3.1 section 3.3.2
Deploy and tune a policy in stages:
- Create the policy in the target resource group, selecting the applicable WAF SKU or managed rule-set type and version. section 3.3.1 section 3.3.2
- Associate it with an Application Gateway v2, or create an Azure Front Door security policy that links the WAF policy to domains. section 3.3.1 section 3.3.2
- Begin in Detection mode, where matching requests are monitored and logged rather than blocked; test intended application features and investigate false positives in WAF logs. section 3.3.2 section 3.3.3
- After addressing false positives, enable Prevention mode to block requests matching the rule set, then keep monitoring as application changes may introduce new false positives. section 3.3.1 section 3.3.3
Application Gateway v2 policy
Create my-waf-policy with the OWASP managed rule set at version 3.2, add Microsoft_BotManagerRuleSet version 0.1, associate it through the Application Gateway --waf-policy argument, then set the policy state to Enabled and mode to Prevention after testing. section 3.3.1 section 3.3.1
Listing 3.10 Creating an Application Gateway v2 and associating it with a WAF policy
az network application-gateway create --name myAppGateway #1 --location northeurope #2 --resource-group bomagusi-rg3 #3 --vnet-name myVNet #4 --subnet mySubnet #5 --capacity 2 --sku WAF_v2 #6 --http-settings-cookie-based-affinity Disabled --frontend-port 80 --http-settings-port 80 --http-settings-protocol Http --public-ip-address myPublicIPAddress #7 --waf-policy my-waf-policy #8 --priority 1 #1 The name of Application Gateway #2 The region in which the Application Gateway is deployed #3 The resource group in that Application Gateway is deployed #4 The name of the VNet #5 The name or the ID of the subnet #6 The name of the SKU; you can associate the WAF policy with Application Gateway v2 only #7 The name or ID of a public IP address #8 The name or ID of the WAF policy you created
The gateway creation command shows the required WAF_v2 SKU and the --waf-policy association point. section 3.3.1
